I think both are hard but often doable! And you can set up processes to limit harm from untrained or malicious people. For some reason this doesn't seem to be

I think both are hard but often doable! And you can set up processes to limit harm from untrained or malicious people. For some reason this doesn't seem to be widely done when it comes to internal "asshole" behavior. Lots of companies require code reviews before software gets deployed or require two signatures on a company check. But they'll have freeform meetings where anyone can speak next if they manage to grab the "floor" and won't maintain records to prevent someone from claiming undue credit for an accomplishment.